3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17

Analysis

max time kernel
187s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-07-2022 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
Size

637KB
MD5

3a911f140e54646eae26dabfec53eff3
SHA1

a2f140bf8005fb2e0c56a87b136f624741e44f24
SHA256

3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17
SHA512

f3d9812302a4de79f51093820411b28b265125d70570e05d48ac3fcbe4d37f75c316a5d0e470c98cf6a9913fe7d8ccbf7112cacdc12c5baf1a33818f4dc8da20

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exeHelpMe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\desktop.ini.exe	aspack_v212_v242
C:\AutoRun.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

HelpMe.exe

pid process

324 HelpMe.exe

pid	process
324	HelpMe.exe

Drops startup file 3 IoCs

Processes:

3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exeHelpMe.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe

Loads dropped DLL 2 IoCs

Processes:

3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe

pid	process
1504	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
1504	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

HelpMe.exe3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe

description	ioc	process
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\A:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\T:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\F:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\R:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\V:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\K:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\W:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\F:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\N:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\S:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\E:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\P:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\H:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\L:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\O:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\B:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\G:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\M:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\Q:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\U:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\X:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\Y:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\Z:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\I:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\J:	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\E:	HelpMe.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exeHelpMe.exe

description	ioc	process
File opened for modification	C:\AUTORUN.INF	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File opened for modification	C:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

Processes:

3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exeHelpMe.exe

description	ioc	process
File created	C:\Windows\SysWOW64\HelpMe.exe	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe

description	pid	process	target process
PID 1504 wrote to memory of 324	1504	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe	HelpMe.exe
PID 1504 wrote to memory of 324	1504	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe	HelpMe.exe
PID 1504 wrote to memory of 324	1504	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe	HelpMe.exe
PID 1504 wrote to memory of 324	1504	3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe	HelpMe.exe

C:\Users\Admin\AppData\Local\Temp\3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe
"C:\Users\Admin\AppData\Local\Temp\3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\system32\HelpMe.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:324

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\desktop.ini.exe
Filesize
637KB

MD5
8aa0b7fead6c16efd7edc8d8302af88f

SHA1
0d2c6ffcf97c236309ea657165d20df99f1a7b19

SHA256
df2818247c68d379387c25da17d847830dced78bf345b3b9ebb13fd8d389a35c

SHA512
9bb3314bce3fe0d0cbad9af26586fe84df35d1e8e846a48fc13b72fb41ec401838901ee82345c4eb90ec0b6ffd833f4b24a409f67b5cbbf23056f4fd212e88b8

Download Submit
C:\AutoRun.exe
Filesize
637KB

MD5
3a911f140e54646eae26dabfec53eff3

SHA1
a2f140bf8005fb2e0c56a87b136f624741e44f24

SHA256
3b50e8a7bb15a231e841c6bb989deff1de7e13e7f4897f7ccdc265469adddc17

SHA512
f3d9812302a4de79f51093820411b28b265125d70570e05d48ac3fcbe4d37f75c316a5d0e470c98cf6a9913fe7d8ccbf7112cacdc12c5baf1a33818f4dc8da20

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
c24777c02545867d9f2d632d55b88cfd

SHA1
1535ae035b55eab8cc20069a9758dfef99de260e

SHA256
bebb55c50e9bb9b2050f0ba0cf7e21265d49322460435a6d51049463d703c236

SHA512
69b0e0897d422745610a3538413fa6217127aac832f66db5c4e2c198427cd6116ac85ad415b52df0a1dcbe6b17f722d92d842f1a23b3102affdbb6f78b21378b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
c24777c02545867d9f2d632d55b88cfd

SHA1
1535ae035b55eab8cc20069a9758dfef99de260e

SHA256
bebb55c50e9bb9b2050f0ba0cf7e21265d49322460435a6d51049463d703c236

SHA512
69b0e0897d422745610a3538413fa6217127aac832f66db5c4e2c198427cd6116ac85ad415b52df0a1dcbe6b17f722d92d842f1a23b3102affdbb6f78b21378b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
6c5b3416d5cbd5f6c80ae01ee558c65a

SHA1
461192f80858d519328f359dd011489f48b185d2

SHA256
34c47defef984cefa5f626c66d417e3c45c52f1d0e395b20c88925730d5f5f60

SHA512
805a38bfb8474e0f20487507e43d6457b6a582880ca62a505b29cfa9172d4c66ebc4f4bdf3880f306a25fb4692b5f6ec283b55cba1c10713989669a9a26accd7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
c24777c02545867d9f2d632d55b88cfd

SHA1
1535ae035b55eab8cc20069a9758dfef99de260e

SHA256
bebb55c50e9bb9b2050f0ba0cf7e21265d49322460435a6d51049463d703c236

SHA512
69b0e0897d422745610a3538413fa6217127aac832f66db5c4e2c198427cd6116ac85ad415b52df0a1dcbe6b17f722d92d842f1a23b3102affdbb6f78b21378b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
c24777c02545867d9f2d632d55b88cfd

SHA1
1535ae035b55eab8cc20069a9758dfef99de260e

SHA256
bebb55c50e9bb9b2050f0ba0cf7e21265d49322460435a6d51049463d703c236

SHA512
69b0e0897d422745610a3538413fa6217127aac832f66db5c4e2c198427cd6116ac85ad415b52df0a1dcbe6b17f722d92d842f1a23b3102affdbb6f78b21378b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
6c5b3416d5cbd5f6c80ae01ee558c65a

SHA1
461192f80858d519328f359dd011489f48b185d2

SHA256
34c47defef984cefa5f626c66d417e3c45c52f1d0e395b20c88925730d5f5f60

SHA512
805a38bfb8474e0f20487507e43d6457b6a582880ca62a505b29cfa9172d4c66ebc4f4bdf3880f306a25fb4692b5f6ec283b55cba1c10713989669a9a26accd7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
c24777c02545867d9f2d632d55b88cfd

SHA1
1535ae035b55eab8cc20069a9758dfef99de260e

SHA256
bebb55c50e9bb9b2050f0ba0cf7e21265d49322460435a6d51049463d703c236

SHA512
69b0e0897d422745610a3538413fa6217127aac832f66db5c4e2c198427cd6116ac85ad415b52df0a1dcbe6b17f722d92d842f1a23b3102affdbb6f78b21378b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
6c5b3416d5cbd5f6c80ae01ee558c65a

SHA1
461192f80858d519328f359dd011489f48b185d2

SHA256
34c47defef984cefa5f626c66d417e3c45c52f1d0e395b20c88925730d5f5f60

SHA512
805a38bfb8474e0f20487507e43d6457b6a582880ca62a505b29cfa9172d4c66ebc4f4bdf3880f306a25fb4692b5f6ec283b55cba1c10713989669a9a26accd7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
c24777c02545867d9f2d632d55b88cfd

SHA1
1535ae035b55eab8cc20069a9758dfef99de260e

SHA256
bebb55c50e9bb9b2050f0ba0cf7e21265d49322460435a6d51049463d703c236

SHA512
69b0e0897d422745610a3538413fa6217127aac832f66db5c4e2c198427cd6116ac85ad415b52df0a1dcbe6b17f722d92d842f1a23b3102affdbb6f78b21378b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
6c5b3416d5cbd5f6c80ae01ee558c65a

SHA1
461192f80858d519328f359dd011489f48b185d2

SHA256
34c47defef984cefa5f626c66d417e3c45c52f1d0e395b20c88925730d5f5f60

SHA512
805a38bfb8474e0f20487507e43d6457b6a582880ca62a505b29cfa9172d4c66ebc4f4bdf3880f306a25fb4692b5f6ec283b55cba1c10713989669a9a26accd7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
c24777c02545867d9f2d632d55b88cfd

SHA1
1535ae035b55eab8cc20069a9758dfef99de260e

SHA256
bebb55c50e9bb9b2050f0ba0cf7e21265d49322460435a6d51049463d703c236

SHA512
69b0e0897d422745610a3538413fa6217127aac832f66db5c4e2c198427cd6116ac85ad415b52df0a1dcbe6b17f722d92d842f1a23b3102affdbb6f78b21378b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
c24777c02545867d9f2d632d55b88cfd

SHA1
1535ae035b55eab8cc20069a9758dfef99de260e

SHA256
bebb55c50e9bb9b2050f0ba0cf7e21265d49322460435a6d51049463d703c236

SHA512
69b0e0897d422745610a3538413fa6217127aac832f66db5c4e2c198427cd6116ac85ad415b52df0a1dcbe6b17f722d92d842f1a23b3102affdbb6f78b21378b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
6c5b3416d5cbd5f6c80ae01ee558c65a

SHA1
461192f80858d519328f359dd011489f48b185d2

SHA256
34c47defef984cefa5f626c66d417e3c45c52f1d0e395b20c88925730d5f5f60

SHA512
805a38bfb8474e0f20487507e43d6457b6a582880ca62a505b29cfa9172d4c66ebc4f4bdf3880f306a25fb4692b5f6ec283b55cba1c10713989669a9a26accd7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
4491a9938b6a28c1b001fa0b2344c92b

SHA1
d3398f1215b2f0c30374c0d17f8d6c421c57fa1f

SHA256
39c4dd6e0a9c6c1ebde3b003fea91a19f399df5c0911105d98c95f5737cce54c

SHA512
ac1abec88e455e9aadb2fc00672f2bf10baad6cabb3f64920dbc20cdcc3909fe85b481dd160f0a3f0ae008b614354228d1ea8004b8e67fcbaee16c6dc13cdbd8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
6c5b3416d5cbd5f6c80ae01ee558c65a

SHA1
461192f80858d519328f359dd011489f48b185d2

SHA256
34c47defef984cefa5f626c66d417e3c45c52f1d0e395b20c88925730d5f5f60

SHA512
805a38bfb8474e0f20487507e43d6457b6a582880ca62a505b29cfa9172d4c66ebc4f4bdf3880f306a25fb4692b5f6ec283b55cba1c10713989669a9a26accd7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
c24777c02545867d9f2d632d55b88cfd

SHA1
1535ae035b55eab8cc20069a9758dfef99de260e

SHA256
bebb55c50e9bb9b2050f0ba0cf7e21265d49322460435a6d51049463d703c236

SHA512
69b0e0897d422745610a3538413fa6217127aac832f66db5c4e2c198427cd6116ac85ad415b52df0a1dcbe6b17f722d92d842f1a23b3102affdbb6f78b21378b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
6c5b3416d5cbd5f6c80ae01ee558c65a

SHA1
461192f80858d519328f359dd011489f48b185d2

SHA256
34c47defef984cefa5f626c66d417e3c45c52f1d0e395b20c88925730d5f5f60

SHA512
805a38bfb8474e0f20487507e43d6457b6a582880ca62a505b29cfa9172d4c66ebc4f4bdf3880f306a25fb4692b5f6ec283b55cba1c10713989669a9a26accd7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
c24777c02545867d9f2d632d55b88cfd

SHA1
1535ae035b55eab8cc20069a9758dfef99de260e

SHA256
bebb55c50e9bb9b2050f0ba0cf7e21265d49322460435a6d51049463d703c236

SHA512
69b0e0897d422745610a3538413fa6217127aac832f66db5c4e2c198427cd6116ac85ad415b52df0a1dcbe6b17f722d92d842f1a23b3102affdbb6f78b21378b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
6c5b3416d5cbd5f6c80ae01ee558c65a

SHA1
461192f80858d519328f359dd011489f48b185d2

SHA256
34c47defef984cefa5f626c66d417e3c45c52f1d0e395b20c88925730d5f5f60

SHA512
805a38bfb8474e0f20487507e43d6457b6a582880ca62a505b29cfa9172d4c66ebc4f4bdf3880f306a25fb4692b5f6ec283b55cba1c10713989669a9a26accd7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
6c5b3416d5cbd5f6c80ae01ee558c65a

SHA1
461192f80858d519328f359dd011489f48b185d2

SHA256
34c47defef984cefa5f626c66d417e3c45c52f1d0e395b20c88925730d5f5f60

SHA512
805a38bfb8474e0f20487507e43d6457b6a582880ca62a505b29cfa9172d4c66ebc4f4bdf3880f306a25fb4692b5f6ec283b55cba1c10713989669a9a26accd7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
4491a9938b6a28c1b001fa0b2344c92b

SHA1
d3398f1215b2f0c30374c0d17f8d6c421c57fa1f

SHA256
39c4dd6e0a9c6c1ebde3b003fea91a19f399df5c0911105d98c95f5737cce54c

SHA512
ac1abec88e455e9aadb2fc00672f2bf10baad6cabb3f64920dbc20cdcc3909fe85b481dd160f0a3f0ae008b614354228d1ea8004b8e67fcbaee16c6dc13cdbd8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
c24777c02545867d9f2d632d55b88cfd

SHA1
1535ae035b55eab8cc20069a9758dfef99de260e

SHA256
bebb55c50e9bb9b2050f0ba0cf7e21265d49322460435a6d51049463d703c236

SHA512
69b0e0897d422745610a3538413fa6217127aac832f66db5c4e2c198427cd6116ac85ad415b52df0a1dcbe6b17f722d92d842f1a23b3102affdbb6f78b21378b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
c24777c02545867d9f2d632d55b88cfd

SHA1
1535ae035b55eab8cc20069a9758dfef99de260e

SHA256
bebb55c50e9bb9b2050f0ba0cf7e21265d49322460435a6d51049463d703c236

SHA512
69b0e0897d422745610a3538413fa6217127aac832f66db5c4e2c198427cd6116ac85ad415b52df0a1dcbe6b17f722d92d842f1a23b3102affdbb6f78b21378b

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
Filesize
492KB

MD5
ad0b8d0a5acae82e01b299db3581b7a2

SHA1
661ac21517f52b216e54e0ef6df2a0b61fce012a

SHA256
df4875fbea7e9d7480e62980d4780c73186df9d4e2fee1029610b5676aac1d6d

SHA512
90d013f653f417a6df090c324de246ccc13bfac962e025776792ed150da3f4a624c0f201beb310c6e89c74345b6241ad4febf7d5e6aeaa12a1349168cdd718dc

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
Filesize
492KB

MD5
ad0b8d0a5acae82e01b299db3581b7a2

SHA1
661ac21517f52b216e54e0ef6df2a0b61fce012a

SHA256
df4875fbea7e9d7480e62980d4780c73186df9d4e2fee1029610b5676aac1d6d

SHA512
90d013f653f417a6df090c324de246ccc13bfac962e025776792ed150da3f4a624c0f201beb310c6e89c74345b6241ad4febf7d5e6aeaa12a1349168cdd718dc

Download Submit
\Windows\SysWOW64\HelpMe.exe
Filesize
492KB

MD5
ad0b8d0a5acae82e01b299db3581b7a2

SHA1
661ac21517f52b216e54e0ef6df2a0b61fce012a

SHA256
df4875fbea7e9d7480e62980d4780c73186df9d4e2fee1029610b5676aac1d6d

SHA512
90d013f653f417a6df090c324de246ccc13bfac962e025776792ed150da3f4a624c0f201beb310c6e89c74345b6241ad4febf7d5e6aeaa12a1349168cdd718dc

Download Submit
\Windows\SysWOW64\HelpMe.exe
Filesize
492KB

MD5
ad0b8d0a5acae82e01b299db3581b7a2

SHA1
661ac21517f52b216e54e0ef6df2a0b61fce012a

SHA256
df4875fbea7e9d7480e62980d4780c73186df9d4e2fee1029610b5676aac1d6d

SHA512
90d013f653f417a6df090c324de246ccc13bfac962e025776792ed150da3f4a624c0f201beb310c6e89c74345b6241ad4febf7d5e6aeaa12a1349168cdd718dc

Download Submit
memory/324-57-0x0000000000000000-mapping.dmp

Download
memory/1504-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads